Threat-hunt your own Windows PC with Sysmon, Hayabusa and Sigma
Your PC has been writing down what happened on it for years: every service installed, every crash, every time antivirus was switched off, every suspicious PowerShell script. Hunters run thousands of community Sigma detection rules over those logs in about a minute and get a ranked list of what deserves a look. Do the same to your own machine, learn to tell real threats from false alarms, then install Sysmon so the next hunt sees every process that ever ran.
- A second opinion from Chainsaw, the other big free hunting tool, run over the same logs
- Sysmon 15 installed with a respected community config, so future hunts see every process, network connection and persistence trick
- Windows 10 or 11, and an administrator account for the Sysmon and Security-log parts (the first hunt works without admin)
- About 1GB of free disk space for the tools, rules and exported logs
- Comfort in PowerShell. Terminal survival kit covers the basics
What you're hunting for, and where it's written down
Know which Windows logs hold the evidence and what the key event IDs mean.
Threat hunting means assuming something might already be wrong and looking for evidence, instead of waiting for an alert. On a home PC the questions are simple: did anything install itself, run in a way that hides what it does, switch off protection or log in when it shouldn't?
The logs that answer those questions:
- Security: logons (4624 success, 4625 failure), new accounts (4720), the log being cleared (1102). Needs admin to read
- System: new services (7045), crashes, unexpected shutdowns
- PowerShell/Operational: script blocks (4104). Windows automatically logs script blocks that contain suspicious-looking code, even with no setup
- Windows Defender/Operational: malware found (1116), real-time protection turned off (5001)
- TaskScheduler/Operational: new scheduled tasks (106), a favourite way for malware to survive a reboot
- Sysmon/Operational (once installed): every process with its full command line (1), network connections (3), registry autostart changes (13), DNS lookups (22)
Sigma is an open format for writing detection rules for logs, with thousands of rules maintained by the community at SigmaHQ. Hayabusa (from Yamato Security) and Chainsaw (from WithSecure) are free, fast, portable tools that run Sigma rules over
.evtxlog files and produce a timeline of everything that matched.Everything in the kitexport-logs.ps1 copies your logs into one folder, and triage.ps1 summarises Hayabusa's results so you know where to start.